Organisation Guardrails across clouds
The policy layer that refuses a resource outright - service control policies, Azure Policy in deny mode, Organization Policy constraints, OCI Security Zones - as opposed to the posture services that report afterwards.
4 verified modules - all static-validated and publish-checked; live-test pending.
Compare by provider
| Provider | Module | Verification |
|---|---|---|
| AWS | Organizations, OUs and Service Control Policies | static-validated |
| Azure | A Policy Assignment that Actually Denies | static-validated |
| Google Cloud | A Constraint that Is Enforced rather than Rehearsed | static-validated |
| Oracle Cloud | A Compartment where the Wrong Resource Cannot Be Created | static-validated |
How to choose
Compare enforcement first: every one of these has a mode that only audits, and a guardrail in audit mode is a dashboard. Then how the policy is scoped (an organisational unit, a management group, a folder, a compartment), what can be exempted and by whom, and whether the platform itself is exempt from the rule.
When not to use
A deny at the organisation level breaks things that were working, sometimes far from where the rule was written. Roll a new guardrail out in audit mode to a test scope first, read what it would have denied, then switch it.